Shared Datastore Authentication With Cryptographic Tenant Groups
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Establishing trust relationships between tenants in a multi-tenant computer system for shared access to a datastore becomes cumbersome and resource-intensive as the number of subtenants and services increases, and managing these relationships becomes unwieldy when entities discontinue use, leading to complex and inefficient access control.
Innovation Solution
Implementing tenant groups to manage trust relationships, where membership in a group determines access rights, using cryptographic verification to authenticate requests and determine group membership, thereby simplifying and scaling access control.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If individual trust relationships are established between each tenant and subtenant, then access control security is maintained, but system complexity and management overhead increase significantly
Solution Approach 1:
The patent combines multiple individual tenant trust relationships into a single multi-tenant system-level trust relationship. Instead of managing separate authentication between each tenant-subtenant pair, the system establishes one unified trust relationship at the system level, allowing any subtenant of any tenant to access any datastore with a single authentication mechanism, thereby dramatically reducing management complexity while maintaining security
Solution Approach 2:
The patent creates a universal authentication mechanism that serves all tenant-subtenant access scenarios. A single authentication protocol and trust relationship structure is designed to handle diverse access cases (different tenants, different subtenants, different datastores) through a common framework, eliminating the need for separate authentication logic for each individual relationship
2Reliability
If cryptographic verification is performed for each access request, then security is ensured, but computational overhead and processing time increase
Solution Approach 1:
The patent performs cryptographic verification in advance when establishing the multi-tenant system's public key, rather than repeatedly verifying individual tenant credentials for each access request. The system proactively generates and distributes its public key to all tenants beforehand, creating a pre-established trust foundation that eliminates the need for repeated cryptographic operations during actual data access, thereby significantly reducing computational overhead while maintaining security
Solution Approach 2:
The patent uses cryptographic hashing to create a compact representation (copy) of the authentication state. Instead of storing or transmitting large amounts of authentication data, the system uses hash functions to generate fixed-size cryptographic hashes that serve as efficient verification tokens, reducing the computational burden of verification while preserving security properties
3Manufacturing precision
If individual tenant credentials are used for access, then precise access control is achieved, but scalability is limited as the number of tenants increases
Solution Approach 1:
The patent transitions from a one-to-one authentication model (individual tenant credentials) to a many-to-many model through a system-level public key dimension. Instead of scaling horizontally by adding more individual credential pairs, the system introduces a new dimensional approach where a single system-wide public key serves multiple tenants simultaneously, enabling exponential scalability while maintaining precise access control through the cryptographic verification framework
Data Source
AI summary
A multi-tenant computer system authenticates access to a shared datastore by a shared service running on the multi-tenant computer system. The shared service is operable to access the shared datastore to execute requests from a plurality of multi-tenant cloud computing services. The requests include an indication of a particular tenant and a particular tenant grouping indicator. Requests are authenticated by cryptographically verifying the request and verifying that the particular tenant is associated with the particular tenant grouping indicator. In response to authenticating a request, the shared service accesses the shared datastore to execute the first request.